From 0a076730adf469918d5d1cfdf9d740c6928208a4 Mon Sep 17 00:00:00 2001 From: Longpeng Date: Tue, 30 Apr 2019 14:21:41 +0800 Subject: [PATCH] usb/xhci: avoid trigger assertion if guest write wrong epid MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit we found the following core in our environment: 0 0x00007fc6b06c2237 in raise () 1 0x00007fc6b06c3928 in abort () 2 0x00007fc6b06bb056 in __assert_fail_base () 3 0x00007fc6b06bb102 in __assert_fail () 4 0x0000000000702e36 in xhci_kick_ep (...) 5 0x000000000047897a in memory_region_write_accessor (...) 6 0x000000000047767f in access_with_adjusted_size (...) 7 0x000000000047944d in memory_region_dispatch_write (...) (mr=mr@entry=0x7fc6a0138df0, addr=addr@entry=156, data=1648892416, size=size@entry=4, attrs=attrs@entry=...) 8 0x000000000042df17 in address_space_write_continue (...) 10 0x000000000043084d in address_space_rw (...) 11 0x000000000047451b in kvm_cpu_exec (cpu=cpu@entry=0x1ab11b0) 12 0x000000000045dcf5 in qemu_kvm_cpu_thread_fn (arg=0x1ab11b0) 13 0x0000000000870631 in qemu_thread_start (args=args@entry=0x1acfb50) 14 0x00000000008959a7 in thread_entry_for_hotfix (pthread_cb=) 15 0x00007fc6b0a60dd5 in start_thread () 16 0x00007fc6b078a59d in clone () (gdb) f 5 5 0x000000000047897a in memory_region_write_accessor (...) 529 mr->ops->write(mr->opaque, addr, tmp, size); (gdb) p /x tmp $9 = 0x62481a00 <-- last byte 0x00 is @epid xhci_doorbell_write() already check the upper bound of @slotid an @epid, it also need to check the lower bound. Cc: Gonglei Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Longpeng Tested-by: Philippe Mathieu-Daudé Message-id: 1556605301-44112-1-git-send-email-longpeng2@huawei.com [ kraxel: fixed typo in subject line ] Signed-off-by: Gerd Hoffmann --- hw/usb/hcd-xhci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index ec28bee319..d8472b4fea 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -3137,7 +3137,7 @@ static void xhci_doorbell_write(void *ptr, hwaddr reg, streamid = (val >> 16) & 0xffff; if (reg > xhci->numslots) { DPRINTF("xhci: bad doorbell %d\n", (int)reg); - } else if (epid > 31) { + } else if (epid == 0 || epid > 31) { DPRINTF("xhci: bad doorbell %d write: 0x%x\n", (int)reg, (uint32_t)val); } else {